Ransomware Delivery URLs: Top Campaigns and Trends
Summary: Unit 42's analysis of ransomware samples from all of 2022 found that URLs and web browsing became the leading ransomware delivery method at over 77% of cases, while email delivery fell to second at almost 12%. Between October and December 2022, Palo Alto Networks' Advanced URL Filtering and DNS Security services detected over 27,000 unique URLs and hostnames hosting ransomware, and more than 20% of the URLs observed were still active days or weeks after being flagged.
What you should know: Most of those still-active URLs were compromised benign domains - 64% of the non-hosting-service domains analyzed had been registered two or more years earlier and averaged 215,892 DNS visits in six months - so the trust in those sites is exactly what carries the payload past reputation-based blocking.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026